Buffer overflow in the rc_mksid function in plugins/radius/util.c in Paul's PPP Package (ppp) 2.4.6 and earlier, when the PID for pppd is greater than 65535, allows remote attackers to cause a denial of service (crash) via a start accounting message to the RADIUS server.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ppp: integer overflow in option parsing (CVE-2014-3158)

  - Buffer overflow in the rc_mksid function in plugins/radius/util.c in Paul's PPP Package (ppp) 2.4.6 and     earlier, when the PID for pppd is greater than 65535, allows remote attackers to cause a denial of service     (crash) via a start accounting message to the RADIUS server. (CVE-2015-3310)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ppp: integer overflow in option parsing (CVE-2014-3158)

  - Buffer overflow in the rc_mksid function in plugins/radius/util.c in Paul's PPP Package (ppp) 2.4.6 and     earlier, when the PID for pppd is greater than 65535, allows remote attackers to cause a denial of service     (crash) via a start accounting message to the RADIUS server. (CVE-2015-3310)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ppp: Remote client crash in ppp EAP-TLS patch (CVE-2018-11574)

  - Integer overflow in the getword function in options.c in pppd in Paul's PPP Package (ppp) before 2.4.7     allows attackers to access privileged options via a long word in an options file, which triggers a heap-     based buffer overflow that [corrupts] security-relevant variables. (CVE-2014-3158)

  - Buffer overflow in the rc_mksid function in plugins/radius/util.c in Paul's PPP Package (ppp) 2.4.6 and     earlier, when the PID for pppd is greater than 65535, allows remote attackers to cause a denial of service     (crash) via a start accounting message to the RADIUS server. (CVE-2015-3310)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the versions of the ppp package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Integer overflow in the getword function in options.c     in pppd in Paul's PPP Package (ppp) before 2.4.7 allows     attackers to 'access privileged options' via a long     word in an options file, which triggers a heap-based     buffer overflow that 'corrupts security-relevant     variables.'(CVE-2014-3158)

  - Buffer overflow in the rc_mksid function in     plugins/radius/util.c in Paul's PPP Package (ppp) 2.4.6     and earlier, when the PID for pppd is greater than     65535, allows remote attackers to cause a denial of     service (crash) via a start accounting message to the     RADIUS server.(CVE-2015-3310)

  - eap.c in pppd in ppp 2.4.2 through 2.4.8 has an     rhostname buffer overflow in the eap_request and     eap_response functions.(CVE-2020-8597)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ppp package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - eap.c in pppd in ppp 2.4.2 through 2.4.8 has an     rhostname buffer overflow in the eap_request and     eap_response functions.(CVE-2020-8597)

  - Buffer overflow in the rc_mksid function in     plugins/radius/util.c in Paul's PPP Package (ppp) 2.4.6     and earlier, when the PID for pppd is greater than     65535, allows remote attackers to cause a denial of     service (crash) via a start accounting message to the     RADIUS server.(CVE-2015-3310)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ppp package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Buffer overflow in the rc_mksid function in     plugins/radius/util.c in Paul's PPP Package (ppp) 2.4.6     and earlier, when the PID for pppd is greater than     65535, allows remote attackers to cause a denial of     service (crash) via a start accounting message to the     RADIUS server.(CVE-2015-3310)

  - Integer overflow in the getword function in options.c     in pppd in Paul's PPP Package (ppp) before 2.4.7 allows     attackers to 'access privileged options' via a long     word in an options file, which triggers a heap-based     buffer overflow that '[corrupts] security-relevant     variables.'(CVE-2014-3158)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the ppp packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Buffer overflow in the rc_mksid function in     plugins/radius/util.c in Paul's PPP Package (ppp) 2.4.6     and earlier, when the PID for pppd is greater than     65535, allows remote attackers to cause a denial of     service (crash) via a start accounting message to the     RADIUS server.(CVE-2015-3310)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the ppp package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The ppp package contains the PPP (Point-to-Point     Protocol) daemon and documentation for PPP support. The     PPP protocol provides a method for transmitting     datagrams over serial point-to-point links. PPP is     usually used to dial in to an ISP (Internet Service     Provider) or other organization over a modem and phone     line.Security Fix(es):Buffer overflow in the rc_mksid     function in plugins/radius/util.c in Paul's PPP Package     (ppp) 2.4.6 and earlier, when the PID for pppd is     greater than 65535, allows remote attackers to cause a     denial of service (crash) via a start accounting     message to the RADIUS server.(CVE-2015-3310)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The ppp package was updated to fix the following security issue :

  - CVE-2015-3310: Fixed a buffer overflow in radius     plug-in's rc_mksid() (bsc#927841).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201701-50 (PPP: Buffer overflow)

    A buffer overflow was discovered in the rc_mksid function in       plugins/radius/util.c in PPP when the PID for pppd is greater than 65535.
  Impact :

    A remote attacker could cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The ppp package was updated to fix one security issue.

  - CVE-2015-3310: Fixed buffer overflow in radius plug-ins     rc_mksid() (bnc#927841).

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2595-1 advisory.

    It was discovered that ppp incorrectly handled large PIDs. When pppd is used with a RADIUS server, a     remote attacker could use this issue to cause it to crash, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated ppp packages fix security vulnerability :

Emanuele Rocca discovered that ppp was subject to a buffer overflow when communicating with a RADIUS server. This would allow unauthenticated users to cause a denial-of-service by crashing the daemon (CVE-2015-3310).

New ppp packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues.

Emanuele Rocca discovered that ppp, a daemon implementing the Point-to-Point Protocol, was subject to a buffer overflow when communicating with a RADIUS server. This would allow unauthenticated users to cause a denial-of-service by crashing the daemon.

Emanuele Rocca discovered that ppp, a daemon implementing the Point-to-Point Protocol, was subject to a buffer overflow when communicating with a RADIUS server. This would allow unauthenticated users to cause a denial of service by crashing the daemon.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198859	RHEL 5 : ppp (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198850	RHEL 6 : ppp (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198776	RHEL 7 : ppp (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
137994	EulerOS Virtualization 3.0.6.0 : ppp (EulerOS-SA-2020-1775)	Nessus	Huawei Local Security Checks	critical
135555	EulerOS 2.0 SP3 : ppp (EulerOS-SA-2020-1426)	Nessus	Huawei Local Security Checks	critical
131891	EulerOS 2.0 SP2 : ppp (EulerOS-SA-2019-2399)	Nessus	Huawei Local Security Checks	high
131364	EulerOS 2.0 SP8 : ppp (EulerOS-SA-2019-2298)	Nessus	Huawei Local Security Checks	medium
130645	EulerOS 2.0 SP5 : ppp (EulerOS-SA-2019-2183)	Nessus	Huawei Local Security Checks	medium
97207	SUSE SLED12 / SLES12 Security Update : ppp (SUSE-SU-2017:0474-1)	Nessus	SuSE Local Security Checks	medium
97206	SUSE SLES11 Security Update : ppp (SUSE-SU-2017:0473-1)	Nessus	SuSE Local Security Checks	medium
96685	GLSA-201701-50 : PPP: Buffer overflow	Nessus	Gentoo Local Security Checks	medium
87088	openSUSE Security Update : ppp (openSUSE-2015-827)	Nessus	SuSE Local Security Checks	medium
83256	Ubuntu 14.04 LTS : ppp vulnerability (USN-2595-1)	Nessus	Ubuntu Local Security Checks	high
83246	Mandriva Linux Security Advisory : ppp (MDVSA-2015:222)	Nessus	Mandriva Local Security Checks	medium
82924	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : ppp (SSA:2015-111-11)	Nessus	Slackware Local Security Checks	high
82864	Debian DSA-3228-1 : ppp - security update	Nessus	Debian Local Security Checks	medium
82863	Debian DLA-205-1 : ppp security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2015-3310

high

Tenable Plugins

high

high

critical

critical

critical

high

medium

medium

medium

medium

medium

medium

high

medium

high

medium

medium